Back to Database
Status published
High
CVE-2018-7187
The "go get" implementation in Go 1.9.4, when the -insecure...
Vulnerability Description
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-7187
Credits & Attribution
No credits recorded in the NVD database.
References
- https://lists.debian.org/debian-lts-announce/2018/02/msg00029.html
- https://www.debian.org/security/2019/dsa-4380
- https://security.gentoo.org/glsa/201804-12
- https://www.debian.org/security/2019/dsa-4379
- https://github.com/golang/go/issues/23867
- https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc
More from golang
View All →CVE-2022-29526
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege...
Medium
5.3
CVE-2022-28327
The generic P-256 feature in crypto/elliptic in Go before 1.17.9...
High
7.5
CVE-2022-27664
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1,...
High
7.5
CVE-2022-27536
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be...
High
7.5
CVE-2022-27191
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker...
High
7.5
Affected Vendor
golang
View all reports →Affected Software
go, debian linux
Vulnerable Versions:
0, 1.10, 7.0, 9.0
Timeline
Official Publish:
February 16th, 2018
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.